Legal
Cookie & Local Storage Policy
Effective Date: November 15, 2025 · Last Updated: October 25, 2026
This policy explains how EVA Online AI, Inc. ("EVA," "we," or "our") uses cookies, local storage, and similar technologies when you visit evaonline.ai or use the EVA dashboard. It works in tandem with our Privacy Policy and Terms of Service.
1. What Are Cookies and Similar Technologies?
Cookies are small text files stored on your device by your browser. We also rely on local storage, session storage, and other identifiers (e.g., Cloudflare Turnstile tokens) to keep your session secure and personalize your experience. Some of these technologies are set by EVA, while others originate from service providers that help us deliver the platform.
2. Why We Use Them
- Authentication: Keep you signed in and route API calls to your account.
- Security: Detect suspicious activity, enforce rate limits, and verify Cloudflare Turnstile captchas on support forms.
- Preferences: Remember the last model you selected, sidebar state, or filters applied across sessions.
- Product Analytics: Measure aggregated usage of features to prioritize roadmap decisions. We use PostHog — no advertising trackers or cross-site tracking pixels are set.
- Performance: Balance traffic across regions, diagnose errors, and maintain availability when upstream LLM providers fluctuate.
3. Types of Cookies/Storage We Rely On
Essential (Strictly Necessary)
Required for the site to function. Includes authentication tokens (stored securely in HTTP-only cookies or secure storage), session IDs, CSRF tokens, and load balancer cookies. Disabling these will break login, chat, and billing flows.
Preference & Productivity
Remember UI choices (sidebar collapsed state), preferred AI model, and locale. These are typically stored in local storage so they persist between sessions.
Analytics & Performance
Collect usage metrics (page views, feature interactions, error frequency) via PostHog. Before you make a choice in the cookie banner, or if you decline, PostHog runs in cookieless mode: it sets no cookies, writes nothing to your device's storage, and does not identify you; the hash is computed from your IP address and browser details with a daily-rotating salt, and the IP address is not stored. Visits are counted using that short-lived, privacy-preserving hash computed on PostHog's servers. Analytics cookies, session recordings (with form inputs and chat content hidden) and Google Analytics are only enabled after you click Accept. With analytics cookies on, Google may also set advertising cookies to measure our ads, unless you opt out under Your Privacy Choices or your browser sends Global Privacy Control.
Third-Party Security
Cloudflare Turnstile sets temporary identifiers to confirm that a real human is submitting support or feature request forms. Google Cloud Storage may set cookies when you upload or download files. These expire automatically after the session or a short retention period.
4. Third Parties with Access
The following service providers may place or read cookies when you interact with EVA:
- PostHog: Product analytics platform. Counts page views and feature interactions anonymously and without cookies by default; sets analytics cookies and records sessions (form inputs and chat content hidden) only after consent. No data is shared with advertisers.
- Google Analytics 4: Measures where visitors come from (search, campaigns) and a small set of conversions such as sign-ups and purchases. Loaded only after you accept analytics cookies. Unless you opt out of sharing, Google may also use this data to measure and improve our advertising.
- Sentry: Error and performance monitoring. Captures unhandled exceptions. Chat message contents are always redacted before transmission. No cookies are set — data is sent via a server-side tunnel.
- Cloudflare: Turnstile captcha tokens and edge security cookies.
- Google Cloud: Session cookies related to Cloud Storage uploads/downloads.
- Stripe: Cookies required to complete checkout securely.
We require our vendors to process personal data under data processing terms, including Standard Contractual Clauses where required.
5. Managing Preferences
Most browsers let you control cookies via settings usually found under "Privacy" or "Site Settings." You can delete cookies, block third-party cookies, or clear local storage at any time. Please note:
- Blocking essential cookies will prevent login and use of the EVA dashboard.
- Preference data (like model selection) will reset if you clear local storage or use private browsing.
- You can change your choice at any time from Settings → General → Cookie preferences, or by clearing your browser's local storage for evaonline.ai to see the banner again. Declining keeps analytics in cookieless mode.
6. Retention & Expiration
| Category | Typical Lifespan | Purpose |
|---|---|---|
| Session/Authentication | Expires when you log out or after 24h idle | Maintain secure access to your workspace |
| Preference Storage | Until cleared or 12 months | Remember UI choices and last-used model |
| Analytics/Performance | 30–90 days | Trend analysis and product debugging |
Campaign source (eva_first_touch_utm, session storage) | Until you close the browser tab | Remember which campaign link brought you here, so it can be recorded if you sign up. Stored only after you accept analytics cookies. |
| Turnstile & Security Tokens | Minutes to 1 day | Prevent automated abuse of forms |
7. Updates to This Policy
We may revise this Cookie Policy to reflect new vendors, features, or regulatory guidance. The "Last Updated" date above indicates the most recent version. Significant changes will be highlighted in the cookie banner or via in-app notices.